CVE-2026-21355

The CVE-2026-21355 entry concerns the DNG SDK, affected in versions 1.7.1 2410 and earlier. It describes an out-of-bounds read that could expose memory contents, with exploitation requiring a user to open a malicious file. The impact is memory exposure, not code execution per the provided text. C...

CVE-2026-21355 DNG SDK | Out-of-bounds Read (CWE-125)

DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim...

Adobe DNG SDK 缓冲区错误漏洞

The Adobe DNG SDK is a software development kit provided by Adobe Inc. in the United States, which allows for the reading and writing of DNG files. Versions of the Adobe DNG SDK 1.7.1 2410 and earlier contained a buffer error vulnerability. This vulnerability stemmed from out-of-bounds read...

Adobe DNG SDK 输入验证错误漏洞

The Adobe DNG SDK is a software development kit provided by Adobe Inc. in the United States, which allows for the reading and writing of DNG files. Versions of the Adobe DNG SDK 1.7.1 2410 and earlier contained a vulnerability related to input validation errors. This vulnerability was caused by...

PT-2026-7429

Name of the Vulnerable Software and Affected Versions DNG SDK versions prior to 1.7.1 2410 Description An integer overflow or wraparound occurs when the software processes a specially crafted file. This issue can lead to arbitrary code execution within the context of the current user and requires...

PT-2026-7430

Name of the Vulnerable Software and Affected Versions DNG SDK versions 1.7.1 2410 and earlier Description DNG SDK versions 1.7.1 2410 and earlier are subject to an Integer Overflow or Wraparound condition. This can result in application denial-of-service, potentially causing the application to...

📄 Samsung QuramDng Embedded DNG Out-Of-Bounds Read / Write

This proof of concept demonstrates an out-of-bounds read / write vulnerability in Samsung's QuramDng image parser, affecting Galaxy S22–S25 devices running One UI 6+. By crafting a malformed DNG that abuses the OpcodeList1 specifically the FixBadPixelsList opcode and embedding it inside a JPEG...

📄 Samsung QuramDNG Type Confusion Detector Vulnerability Scanner

This C++ scanner analyzes DNG Digital Negative files for the CVE-2025-58478 type confusion vulnerability in the libimagecodec.quram.so library used on Samsung devices...

📄 Samsung Quram DNG Heap Corruption

Samsung devices utilize Quram's DNG decoder. A malformed ScalePerColumn opcode with oversized areaSpec and extreme pitches leads to arithmetic overflow in the per-column scaling loop. After allocation miscalculation, subsequent writes corrupt heap structures. Carefully crafted payloads enable...

📄 Samsung QuramDng Warp Out-Of-Bounds Read

This python proof of concept demonstrates an out-of-bounds read vulnerability in Samsung's QuramDng image processing library, triggered via a specially crafted DNG Digital Negative file. The script programmatically builds a minimal but valid DNG file containing a malformed WarpRectilinear opcode,...

📄 Samsung Quram DNG Remote Code Execution

A vulnerability exists in Samsung's image decoding library libimagecodec.quram.so responsible for parsing Digital Negatives DNG. A malformed DNG containing oversized IFD entries can cause heap corruption. With precise heap grooming, this condition may lead to remote code execution when the...

📄 Samsung Quram DNG Advanced Remote Code Execution

This proof of concept uses an advanced exploitation technique that allows a remote attacker to execute arbitrary code on a target device by carefully controlling and manipulating memory in the target application or library. This technique is particularly used against memory-sensitive libraries li...

📄 Adobe DNG SDK RefBaselineABCDtoRGB Out-Of-Bounds Read / Information Disclosure

This work presents a technical, research‑grade proof of concept demonstrating CVE‑2025‑64893, an out of bounds read vulnerability in Adobe DNG SDK versions prior to 1.7.1.2410. The vulnerability is caused by a logic flaw in the rendering pipeline where a crafted but specification‑compliant DNG fi...

📄 Adobe DNG SDK 1.5 Integer Overflow / Local Crash

This proof of concept exploit demonstrates a local crash condition caused by an integer overflow vulnerability in the Adobe DNG SDK versions 1.5 through 1.7.0. The provided Bash script dynamically generates a malformed DNG image file containing a crafted opcode list that abuses the ScalePerColumn...

📄 Adobe DNG SDK RefBaselineABCDtoRGB Out-Of-Bounds Read / Information Disclosure

This work presents a technical, research‑grade proof of concept demonstrating CVE‑2025‑64893, an out of bounds read vulnerability in Adobe DNG SDK versions prior to 1.7.1.2410. The vulnerability is caused by a logic flaw in the rendering pipeline where a crafted but specification‑compliant DNG fi...

Adobe DNG Software Development Kit (SDK) Input Validation Error Vulnerability

Adobe DNG Software Development Kit SDK is a software development kit from the American company Audobee Adobe. An input validation error vulnerability exists in Adobe DNG Software Development Kit SDK, which can be exploited by an attacker to execute arbitrary code on a system or cause an applicati...

Adobe DNG Software Development Kit (SDK) Denial of Service Vulnerability

Adobe DNG Software Development Kit SDK is a software development kit from the American company Audobee Adobe. A denial of service vulnerability exists in Adobe DNG Software Development Kit SDK, which can be exploited by attackers to cause a denial of service...

Adobe DNG Software Development Kit (SDK) Heap Buffer Overflow Vulnerability

Adobe DNG Software Development Kit SDK is a software development kit from the American company Audobee Adobe. The Adobe DNG Software Development Kit SDK contains a heap buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code on a system or cause an application...

A look at an Android ITW DNG exploit

Posted by Benoît Sevens, Google Threat Intelligence Group Introduction Between July 2024 and February 2025, 6 suspicious image files were uploaded to VirusTotal. Thanks to a lead from Meta, these samples came to the attention of Google Threat Intelligence Group. Investigation of these images show...

CVE-2025-64894

DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this issue to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction ...